aa10c6c886272234bd92863f599f9558250e81ac316e03ccfc54e1f88ba527c2

Analysis

max time kernel
134s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 20:07

Target

aa10c6c886272234bd92863f599f9558250e81ac316e03ccfc54e1f88ba527c2.dll
Size

51KB
MD5

24809a57242e0a178f3646330cab3790
SHA1

7d449f65f00f4c46d02e9578607f1a3c79bf83fe
SHA256

aa10c6c886272234bd92863f599f9558250e81ac316e03ccfc54e1f88ba527c2
SHA512

c114e9dfac1c7864f80b6bedb109e403d3d3c9f8e5c49fa64d5beb7c1d1807aac8c3816ac0e744ed99a941e6e6f0711b1d0925614d7b0a75495fe52e478819b2
SSDEEP

768:keYiY4baIbMSoPF0FSn+hhORX9iLMFaN88345LQxGOsIZrKSA0ukMtXrqD5oKEA:vM7IASjo+QX9OP88OLQx1sUrz3ZD9l

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 4532	1800	rundll32.exe	79
PID 1800 wrote to memory of 4532	1800	rundll32.exe	79
PID 1800 wrote to memory of 4532	1800	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa10c6c886272234bd92863f599f9558250e81ac316e03ccfc54e1f88ba527c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa10c6c886272234bd92863f599f9558250e81ac316e03ccfc54e1f88ba527c2.dll,#1
  2⤵
  PID:4532